CVE-2018-18495
Publication date 11 December 2018
Last updated 24 July 2024
Ubuntu priority
WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. This vulnerability affects Firefox < 64.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| firefox | ||
| 18.04 LTS bionic |
Fixed 64.0+build3-0ubuntu0.18.04.1
|
|
| 16.04 LTS xenial |
Fixed 64.0+build3-0ubuntu0.16.04.1
|
|
| 14.04 LTS trusty |
Fixed 64.0+build3-0ubuntu0.14.04.1
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
6.5 · Medium
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | None |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
References
Related Ubuntu Security Notices (USN)
- USN-3844-1
- Firefox vulnerabilities
- 11 December 2018